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(TSHSIHREL) Only RAT Analysts can submit QUANTUMTHEDRY Tasking tn the
QUANTUM team. TDPI Anaiysts can submit QUANTUMNATiC-N Tasking threugh
Target Prefiler. The biggest difference is QUANTUMTHEDRY depldys a stagel implant
called UALIDATDR {seen te be COMMONDEER} and QUANTUMNATIDN depleys a
stageﬂ implant ealled SEASUNEDMDTH (SMDTH). SMUTHs die within 30 days of
deployment unless requested to extend the life.

(TSHSIHREL) This presentatien dues net seuer FAA QUANTUM but if yeu identify an
active selector, epmpare the SIGAD in Marinate the SIG-AD en the GO QUANTUM wiki
page td see if FAA QUANTUM is an eptidn.

(TSHSWREL) This presentatien is geared tewards targets seen at US—
unfamiliar 1with this SIGAD. it is equivalent to a TSHNF SlGAD that eannet be
mentiened in this PdwerPdint. You can eentaet the PDC at this brief for mere
infermatien.
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WED BTQWSllﬂg (Exploit with QUANTUM

- Themcept man—on—the-side}

- QUANTUM is a man—on—the—side capability. If your target has a selector
that is actiye in the last 14 days, yulnerable to the QUANTUM technique,
and seen by an 550 site that has QUANTUM capabilities. then there might
be the opportunity to detect that communication in real-time and piggy
back with the requested content back into the target’s network and
implant the host.

QUANTUMTHEORY can be used only if a TAO Project is set up [must
coordinate with your R&T Analyst}

QUANTUMNATIDN can be used regardless of a TAD Project {TGPI does the
tasking in Target Profiler)

The biggest difference is QUﬂNTUMTHEDR‘r’ deploys a stagel implant
called VALIDATOR {soon to be COMMONDEER) and QUANTUMNATFDN
deploys a stageU implant called SEASUNEDMOTH (SMOTH). SMOTHs die
within 3G days of deployment unless requested to extend the life. The
exploit technique is the same.
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What i5 QUANTUM?

QUANTUM Generic Animatinn — High Level 0f How It Wurks
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What i5 QUANTUM?

QUANTUM Generic Animatien — High Level ef How It Werks
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What is QUANTUM?

QUANTUM Generic Animatien — High Level ef Hew It Werks

1. Target logs into his
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What is QUANTUM?

QUANTUM Generic Animatien — High Level of Hew It Works
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What is QUANTUM?

QUANTUM Generic Animatinn — High Level of Haw It Works
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What is QUANTUM?

QUANTUM Generic Animatien — High Level ef Hew It Werks
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What is QUANTUM?

QUANTUM Generic Animatien — High Level 0f Haw It Werks
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What i5 QUANTUM?

QUANTUM Generic Animatien — High Level ef How It Works
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QUANTUM Capabilities — NSA

{TSHSIHRELJ NSA QUANTUM has the greatest success against strange}. sfaeeheeke,
and Static IP Addresses. New QUANTUM realms are eften changing. so cheek the
wiki page er the QUANTUM SpySpaee page re get mere tip—te—ttate news.

NSA QUANTUM is capable of targeting the following realms:
- - |Pv4_public - mailrqucu
- alibabaFerumUser - msnMaith::|<en6-ﬂr
deubleclicle - qq

emailAddr - facebeek
recketmail - simbarUuid
hiSUid - twitter
hetmailClD - yahee
linkedin - yaheeBceekie
mail - ymail

mailrqucu - yeuTube
msnMailTeken64 - WatcherlD
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QUANTUMTHEQRY — GCHQ

If a Partnering Agreement Form PAF is set up with GCHQ for
the CNO project, then the R&T Analyst can utilize GCHQ
QUANTUMTHEORY to include additional capabilities such as:

- - ALIBABA - AOL
BEBo_EMAIL - DOUBLE_CLICK
FACEBOOK_CUSER - GOOGLE_PREFID
GMAIL - H|5

HOTMAIL ' LINKEDIN

MA|L_RU - MICROSOFT_MUID
MICROSOFT_ANONA -RAMBLER
RADIUS - SIMBAR

- TWITI'ER . YAHOO_B

- YAHOO_LJY - YANDEX_EMAIL

- YOUTUBE - IP Address
More information on: https:iiiii'iiiir-ti.gchg;If IQUANTUM_BISCUIT
If you cannot get to the link try: httpdi‘
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UANTUM EV — QiZDS

(TSHSI iREL) Find all Selectors associated to your target (Yahoo,
Yahoo B Cookies, Facebook, Hotmail, etc} using Marina, NSA or
GCHQ QFDs.

NSA SATC QFDS:

ALTEREGCI QFD:

GCHC

 

ﬂueried selector Alternate Selector lSiuerieli alternate Intersection Scare

Selecrei Selecter I1-I-2IIJ-
Degree Elegree

DDGCDLLAR QFD:

Eelertrr lira:- Enri-:hrr-eii"eli.e emotions Fraser Dare Lari Seen Date
:[-_1 - :5. 1‘.

Skip to Step 5 once you have all of your selectors“.
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QUANTUM SEGDEV — Marina

Step 1: Skip to Step 5 if 1yruu used the QFDs te ideruzifyr alternate selectors

-' {TSHSIHRELJ if ysu do not use the GCHQ er NSA QFDs you can use Marina. Run 61
Marina Seiecterﬂdenﬁﬁer Preﬁie (Federated) search fer a 3 munth range m issk fer
additional selectors.
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-' {TSHSIHREL} Once the query finishes, leak at the Equivalent tDs section. This will shew
ydu ether seieeters that grew target is using. This is determined by linking eentent
(leginsiemail registratidnsi’ete). it is werth verifying that these are indeed seieetdrs
asseeiated te yeur target. NSA QUANTUM works best against syahees and
r:faeeidisek‘sa Atthdugh, it is werth making note at a sgmails seleetdr fer pessible GCHQ
QUANTUM suppdrt er tdr year dwn netes.
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(TSHSIHREL) it year search was en a syaheee email address, then click en Machine
IDs and leek fer a recent syaheeBceekiee. YaheeBceekie's are unique te a speciﬁc
cernputer and can held ether syaheee addresses that are being legged inte en that
cemeuter as Ieng as the user dees net clear brewser ceelcies. If yee see multiple
syaheeBceekie} pick the mest recent Last Heard date. Alse higher the Nam Heare‘ is,
the mere liker that selecter dees net change.
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New cgeegle} eeIEctm
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{TSHSWREL} Since - ' - is a new select-atr you will want to
dc a Marina Selectcr Pralile query.r an it to see if there are additianal acccunta
aasc-ciated to the target. Remember NSA QUANTUM canncit target the cgccglea
aetectcr.
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-' (TSHSIHREL) Change the query m search for the last 3 Months and click SUBMET
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(TSHSIHREL) Once the query finishes, look at the Equivalent IDs section and make
note of any new syshoo; shotmaile. syahooBoookie‘e-E and sfeeebooke seleotors and

do the some process to identify additional selectors.
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New Faoehoolt Selector
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Ali Unioue Selectors Found From Both Searches:
- syahooe [Known Selector
l
@gmeiltomsgoogle} INew Selector}
sysltooEeooI-ttee {New Seleelm}
slaceboolte [NIE'H'J Soloﬂtor}
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{TSHSIHREL} Dnee yeu haye a list at yeur seleeter(s)_. yeu 1.ririll want to leak at each ene
separatety te cheek fer the iikeliheed ef successfully expieiting your target yia NSA
QUANTUM. We are checking to see if the target itseif is seen at US- and if it is aetiye.

(TSHSIHREL) First we want he run a Marina Active UserfPresence (Federated) search err
fer the east 1:1 days.

 

 

 

1-1 Days
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if yeu have DVSClTUD. cheek this
if has re search ECHQ databases
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{TSHSIHREL} “fee will either have results er net have results. The key is te leek at the
SIGAD fer the results and it the SIGAD is eapable ef deing QUANTUM then you mest
liker have a vulnerable target! Te check for SIGADs that NBA and GCHQ QUANTUM
can target type _ in yeur brewser. if GCHQ QUANTUM is needed then

werk with yeur RAT Analyst te feliew the apprepriate steps en the wiki te set up a PAF.

[TSi’iSIHRELju Yeu will want te leek at the Marina results and make nete ef the mest
frequent SIGADHP CIDR fer eaeh Active UserrPreseeee (Federated) queryr

1] Selecter
a] SlGAD

ls} Active User iF' CiDH — The CIDR will he added te the TLNis Whitelist.

~A TLN's Whitelist is a list eentaining the IP CIDFEs yeur target uses. it is where the

FOXACED sewer will enly eentinue with expleitatien if the external IP Address at
the targetlredireetien is en the Whitelist fer the TLN yeur RAT Analyst requests
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is My Selector Tasked for
QUANTUM?

If you sent your R&T analyst a selector to task for
QUANTUMTHEORY and you want to see if it has been tasked yet,
you can enter the selector in Target Profiler and if you see “tasked
for survey” and the Technique to be QUANTUMTHEORY or
QUANTUMNATION then it is tasked! You can also see when the last
FOXACID redirection took place.
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QUANTUMNATlON

QUANTUMNATiON uses new Trio CNE tradecraft and automation to drive broad
scale initial access, specificallv an SEC: cloud-analvtic to identify selectors in 550
passive collection that are viable for end-point access, and the use of lightweight
CNE implants to obtain initial access and survey data delivered to the TOPI offices
via corporate SiGINT repositories. For More Information on QUANTUMNATION check
the QUANTUMNATIDN wiki page

Target Profiler now shows if a selector is vulnerable to a QUANTUM exploit. If your
target is valid for QUANTUMNATiON, A "Vulnerable" link in Target Profiler will

appear. Simply click the link that sends an email to request DUANTUMNATIDN
tasking.
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Note: QUANTUMNATION and standard QUANTUM tasking results in the same
exploitation technique. The main difference is QUANTUMNATION deplovs a stage D
implant and is able to be submitted by the TDF‘l. Anv ios device will always get
VALIDATDR deployed.
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-' (TSHSIHRELJ Dnce yeti have a selecter. SiGAD. and IP CIDR. 5rch are readyr tc start
the process fer a FDXACID TLN and Tag request.

4 (TSHSIHREU Depending en the teams. either an REL-r analyst er the Branch IChief can
create a TLN (Twist Leela}; Number). Centact yeur Branch Chief fer inferrnaticn cn
creating a TLN fer each selecter yeu want tn target.

4 (TSHSIHRELJ Nate: Yen will need 1 TLN and 1 FOXACID Tag per selector y'CILi task with
QUANTUM.
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Step 8:

- {TSHSIHREL} Dt‘ice you have a TLN, you will need to submit a FDXACID Tag request.
(TSHSIHREL) Ge [0 ' and [ill eut the eppmririate
infermatieh in the tap and within the bed}; at the ticket update this infermatieh aeeerdingly. Here is an example:

ELL}! .ﬁeﬂzﬂl Non-CT

Seemed Parttri'Perthering: Nu
Ce e. L1H}! .Eteeiueﬂme;
Fi-EriﬁﬁTeteet; Ne

It'eeetﬂp; QUANTUM
wiﬂtieﬂm; Nu
Emieetﬂeteeg

I_|:H_;12345 '=' Insen: Iit"uur TLN

.LE‘uﬂaﬂgg; " Insert Your Active User IF' CIDR i' WHITELEST
MAC Addreseﬁ Unknewn

Eeztteettﬂetteegtett; iital
Weemeaet
eage-
hﬁﬂiutleﬁt Ne

EiIIf-HMF i HHUIZT'IIZIIrJII‘III-ﬁﬂl I 17LIIE5ut3rI
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(TSHSIHREL) Once the EleE‘I is eertteletedr tree will receive an email with the FDXACID
Tag fer yeer TLN.

(TSHSIHREL) Ge te htteea'l .nsa.ie.getr. lindettphp and
fill eat the apprepriate infermatien in the term te task year eeleeter and tag fer
QUANTUM.

(TSHSIHRELJ Ghee yeer eeleeter is tasked fer QUANTUM yeu will see the status
changed te eemplete.

(TSHSIHREL) The last Step it te merriter the TLN in FDXSEARCH
httpeelr .nea te leek fer

redireetiene and update the elegihe er WHITELlST if needed.

[TSHSIHFEELJ De—taek yeer QUANTUM reeueet wheh tree heel: yeur target!
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1f you have any questiﬂns or mmments abnut this presentatinn, please send an email
to -at-@n5a.ic.gnv
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